Jenkins Governance Meetings, 5 May 2021

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Jenkins Governance Meeting, May 05, 2021

Description

Recording of the Jenkins Governance meeting. At this meeting we discussed the recent news: 2.277.4 Release, SheCodeAfrica contributhon completion, DevOps World CFP, and 5 years since the Jenkins 2.0 release. After that we confirmed Oleg Nenashev as the candidate for CDF TOC project representatives from Jenkins. Then we discussed removing Commons Digester from the Jenkins core and agreed on the next steps. We also voted on terminology and finalized some terms like "built-in" node. Then we confirmed the pilot project with the Linux Foundation and Snyk, focused on securing Jenkins delivery pipelines and adopting LFX Security 2.0.

Meeting notes: https://docs.google.com/document/d/11Nr8QpqYgBiZjORplL_3Zkwys2qK1vEvK-NYyYa4rzg/edit#heading=h.69hapn3otwah

A

Hello, welcome to the junkies governance meeting today is may 5th and we have multiple participants on the call. So we are doing a regular session. We've got a lot of items uh to discuss today. uh Gavin will be taking the meeting notes thanks a lot to him for the previous meeting.

A

The meeting notes were maybe three times larger than before and yeah. Everyone else is also encouraged to contribute, because this document is shared for editing.

A

Okay, let's start from use the first big news, which of course we missed is five years since the drink has to be zero, so it happened on april, 20, 2016 and so well, just congrats.

A

We didn't do much celebration around that. There is still an opportunity to do that. Someone is willing to take the section item but yeah. It's just for your information.

A

Thanks to the zero was nice. We introduced the pipeline by default. We did plugin unbonding. We also.

A

Did quite a lot of changes here and there and removed the agents from the terminology so yeah there are some things. uh Sorry, we removed slaves from the terminology, so definitely something to celebrate yeah. So if anyone wants to take an action item on that, please do so. Otherwise it will be probably just a tweet. Okay.

A

Other news: we've got uh 2.277.4 release. It was just a few hours ago mark. Would you like to summarize it.

B

Released had some infrastructure surprises. Delighted has a relatively few back ports um we'll be discussing I'll, be discussing with darren pope in a live stream later this week as well.

A

So basically, everything is already available for downloads right.

B

It is confirmed available. We will upgrade ci.jenkins.io later later today, as it gets a little less busy yeah and that's not the securities.

A

So, basically, if you're affected by the issues and if you want to get a backboard just update when you're ready.

A

Okay, then she could africa's summary. Maybe.

B

For you again mark yeah, so five uh five women from africa were part of a large contingent of people who applied for the opportunity to spend one month contributing to open source software jenkins and two other projects were the mentoring organizations. Five mentors from jenkins, assisted as these. This group of five women contributed pipeline, help examples.

B

uh Pipeline documentation uh project was a great success. Plenty of things that we learned from it retrospective will likely happen this friday with with them. We've got a good retrospective document already assembled and we'll gather it a little further and then do one final meeting. To be sure we capture the things we learned so that we know how to do this better. The next time is there going to be.

C

Any um is it, I don't know how to ask a question.

D

C

Is the uh retrospective plan to be like? Are you planning to take your learnings from retrospective and share it to the wider audience, or is it gonna be limited to this event, and how are you going to do it.

B

So I'll I intend to do a blog post to jenkins.io, highlighting it I'll I'll, probably include notes from the retrospective. In that blog post, the the the participants were also willing to assist in a talk at devops world, so I'm going to propose a talk at devops world, for it we'll do some other things like that. I think oleg had also suggested an online meetup and again I think that's a great idea that we should consider as ways to highlight hey it's it's possible to come into the jenkins project contribute significantly.

B

uh Even if you have no prior java experience in less than 30 days, we got these people ramped up, compiling plug-ins loading, those plug-ins working with them. It was. It was a good experience. I think now lots of lots of things we learned and we'll do better. Next time.

A

Yeah, my shoulder is our respective dog. I.

B

Think it's it's just it's in it's in the same document. It's in the.

A

B

Section there page 14 and beyond.

A

Right so we will just shape it.

A

So again, eventually the document will be referenced uh somewhere from jacques misao. Maybe.

B

Yeah, that document actually already that the top level of that document is already referenced from jenkins.io. But we'll we'll do a summary of the retrospective. I think it would be a good part of the blog post yep. That's for.

A

Sure you do the same for gsoc, okay, anything else in chico africa, then uh thanks a lot to mark uh christian, angelic and mack mark roberts for running this event and from entering there. We hope it was a great experience for everyone. Of course, thanks for the to the mentees.

E

Thanks to all mentors and obviously mentees.

A

Okay, moving on devops vault uh call for papers, so, firstly, it happens. It was announced. The deadline is made when it is so. We will have just two weeks left um yesterday to get episodes.

A

We did jenkins online meetup about the community agenda, so at this meetup we basically spent some time to provide overview of what we are doing as jenkins communicate devops world and also there was a discussion of what to do is a part of cfp, so the recording is already published same for the slides, so we can take a look and yeah if you just want to feel some nostalgia definitely go to this presentation because I put a few photos. There.

A

But yeah so let's set up the overview, so the presentation was relatedly short and yeah, see.

C

Sorry was it, this was the presentation of that was given at the meet up, or is this a presentation for people.

A

Yeah at the meetup, so basically we need to get the user lisa. We will be doing another session uh next week for park time zone together with rick and maybe victor martinez, but yeah so yeah he can see. Mark evelina was also william somewhere yeah. Here's zula yep so nice times, hopefully you'll be able to repeat it. Some time.

E

There's another.

C

He said another one would be next week for the apoc.

A

A

So basically, we just wanted to provide some overview, provide some concepts because again, devops world is more than just a conference for us. We all also want to have contributor summit and other things, many things actually tbd, but yeah. Hopefully they will be confirmed just a second yeah. So what we have confirmed by the moment, we will have two community workshops.

A

One is about uh contributing to jenkins. Another is likely about jenkins pipelines tbd. Then they will be community track. Also, there will be continuous delivery foundation track, which will also include some talks about jenkins practitioners track may include them as well, then community keynote is to be decided most likely, it will be by the continuous delivery foundation.

A

But if you have major announcements to share the jenkins project welcome, then they will be asked the experts and hopefully contributor summit, all to be confirmed, and we are not doing junkies awards so this time, because jenkins awards will happen at cdcon and gentle reminder to everyone. We still have some time to submit nominations, so it's open until may 14th.

A

C

Might be worth for the keynote to have. uh um I know it's a later topic, but plug-in deprecation um policy should be a good one to announce there.

A

Not sure, but it's definitely something to be discussed so again, I don't know how much time we would get. What would be the scope there were discussions about jenkins, 3 or something like that. If we do junkies free announcement, we can just merge the plug-in duplication under that, but yeah in the current state.

A

It feels unlikely that you will be able to announce it in autumn, even if everything goes well because yeah the match window will be mid to july, and it's just two months from now yeah, I'm still not allowed to go to the community. With my proper useful proposal.

A

Okay, so yeah anyway, there are three dominations for yankees project.

F

Well, a quick question regarding the keynote aren't keynote is usually good news. How would you think that the plugin deprecation policy is positive for any users? It's not like we're doing.

F

It's not like we're improving the situation there, we're just making it easier for us to make changes, but uh the obvious side effect is that all of those terrible long tail, plugins that haven't been updated in years, will stop working rather than limping along as they do today.

F

So that really doesn't feel like and let's get up on stage and proudly proclaim that we're breaking everyone's jenkins kind of topic. I think we're calling a bit here.

A

So yeah, I think you're right, but it's something to be discussed and.

G

Yeah, I think, there's a positive way to phrase it as long as, indeed we can show that we have done other things and saying this is a way for us to focus our energy on what is actually you know, making jenkins go. You know forward, rather than focusing on making nine years old plugins that nobody really uses like 60 times or something installed worldwide, to keep to keep those ones working. I think people would prefer the community to work on making. I don't know pipeline shine even more or something.

F

We are already not keeping them running, as evidenced by tables to divs. So I really oh well. uh We have a lot of topics. So let's discuss this yeah.

A

I suggest two more one, because right now we don't even have consensus of what we do not uh everywhere, but yeah, let's see so what else can and nominations. I just put the link what is important topic today, that there are only three limitations listed in our blog post, but there are denominations where jank's contributors may be potentially eligible.

A

So there are also a global cdf eliminations, like top cdf ambassador to cdf contributor, guitars evangelist.

A

We, I guess we already have jinx contributors in all categories, but if you think about someone just put them here and there we also two new awards just announced the last week: it's a top cd of end user and top githubs and user.

A

So basically it would be just a company or former using let's say one of jenkins projects.

A

That's for example, and again, if you have a company which would be a big highlight, think about that. Maybe it's also enough, but you need to nominate someone.

H

A

On uh yeah, so just a quick update. um Just a few hours ago, we've got information about number of slots. We get so announcement that yeah we will have changes projects this year.

A

The number of projects is to be announced and the projects are also to be announced. The announcement will happen on may 17th. So it's two weeks from now.

A

But yeah, I think you will like the announced projects.

A

Yeah, basically, that's it about gsoc we're still in the dark mode until the projects are announced.

A

Mark you want to task something.

B

I I was just going to note that we are in dark mode, so no comment should be made by us right because that's google's thing to announce not ours right or like that's the the way it is it's. We will do our announcement.

A

As well, but firstly, it should be official on the google side, because, firstly, decisions may change. Some students may appear to be not eligible. There might be other organizations reaching out and discussing her duplications. So we are not ready to do announcements by now, because it may.

A

Change yeah, so yeah. Some people want this cola in the mentor channel, so you will be able to see the summary by the end of the day.

A

Okay, so moving on, confirm the cdf talk project representative. uh So for those who were not following this threat, they could easily announce the elections for talk members. They will. There are changes, because this year they will be actually electing uh four representatives among six projects, but each of six projects are expected to make an animation and what it means that we as a jenkins project, should also nominate someone and the deadline is may 14th. So we still have some time, but this is the last governance meeting before the nomination happens.

A

So unless we change the pro it says we should sign off the elimination. Today, though, if anyone wants, we can extend it, but we will need to agree what would be the process after that and yeah. Currently, basically, it's only me nominated yeah.

A

If someone uh wants to eliminate themselves or no, we need someone, it's a great time to speak up.

F

I'm not getting out of this.

B

I don't see any reason to extend it. Yeah full support from me for you being the nominee, oh like thank you for being willing.

H

Yes, thank you.

H

H

I

Yeah I was, I was showing a thumbs up, but then I realized that probably you have the browser full screen or something so.

A

I have several faces, but uh you are not on the screen at this time. Yeah too many people this week.

I

No, I'm happy, I'm happy with you being our candidate. Definitely.

A

Okay, then, I think it's confirmed.

A

Thanks everyone, there will be still elections ahead. I have no idea how these elections will happen, uh but yeah we'll figure out as we go and yeah other projects also are for election. So jenkins, eggs will be like making the elimination same footage tone same for spinnaker and now the results screwdriver and arp stereos. So they will also make eliminations.

A

A

So anything else on cdf talk, representative.

A

And the topic from batiste about removing common digester from the core.

G

Yep, so for anybody who didn't have the time to read the developer developers mailing list, I sent a heads up there too, about this removal, so we are working uh to update jenkins. So um in short, you may have seen- or you may be aware- that jenkins has commands digester 2.1 in its dependency tree, which is the dependency that was released in 2010, so it's even older than guava. So after many discussions with various people, including especially in that thread, we got feedback from some people. I think jesse mostly said something like that.

G

Digester is not even fixable. Really, we should just get rid of it. So, instead of trying to you know, update it to commence gesture 3, which anyways has a different fqn, we decided to just remove it all together, but then it would have. The second step would be it was to decide. You know whether we would create a detached plugin uh and then again I think what we've done is partly based on the feedback of the jc's one, which I remember.

G

I think team said something similar that you know we should be creating a detached plugin unless we can fix the ecosystem, which is what we're doing so. We pursued this the latter, because you know also we don't think uh when I say we it's it's, I I I'm trying to speak for the jenkins project, but obviously that's more my opinion at this point, um but removing it is a more uh cleaner thing to do.

G

Obviously, this has a the big and obvious caveat that I think danielle uh pointed out uh on the pr itself at some point before we we fixed some more a few more things and on the thread on the dev list, so we filed a pr for every single plugin we could find was using it, but many many plugins have been abandoned for years. So I guess we have to list that as the community, whether we release those old things that that are not even installed a lot of times in the world, maybe sending an abuse.

G

You know message to the world that those plugins are maintained, somehow which they are not really or we have accept that this is one of the one of the first or at least one occurrence of 15 years uh that that was, you know, posted on kids. I website already almost three years ago about the fact that you know to move to the jenkins project forward. We need to break a few things again.

G

We filed a pr for everything that is impacted, but again I don't think many of those will just find somebody willing to just you know own this, maintain it merge it release it. Basically.

C

um So I got two questions. um One there's probably a lot of people like me that have no idea what this does and why we want to keep it versus why we want to remove it um yeah. Actually, it's just the one question. So what does it do.

G

Digester is a library for parsing xml, at least I I think it's only what it does. um The the big thing is that, even if some people could be still using the library per se, uh it has wrong defaults.

G

I would say I'm just repeating my understanding, especially from people like daniel who uh insisted that you know we make sure that the the the way digesters is uh um instantiated is using the the the non-default settings to be secure, and uh I think jesse said something like this on the pr that you know, there's no way, no easy way to make this secure, really and more importantly, the the fully qualified package names of this library anyways changed between the the version that we are removing and the version three so effectively upgrading would mean anyways upgrading the ecosystem.

G

Like we're doing so, you know it's that's why removing it from the core, because again it's a library from 2010 which is the facto you know not a great thing in into new 2021 11 years old library, which is stuffed with with known cves most. If not, all of them are unreachable normally, but it could be someday or basically also making the security posture of jenkins in the world not great. When companies basic basically scan jenkins, they find a lot of things that you know make them again.

G

My opinion in 2021, more and more complex, more and more tricky that the security teams accept this this tool, you know in their toolbox. You know.

C

So looking at oleg screen share when you created the prs for other projects, did you just um looks like you upgraded to digester 3 where possible and then, where your plan was to remove it from core entirely.

G

Yep, this is what you're seeing right now, so not not right now, sorry, this is emma.

G

This is basically one of the plugins that we think will will never get a release uh if, if you go back a leg or another tab or something to original pr, uh you will see that I've I've created uh this this table here, that's basically pointing to everything, that's impacted and when I put on the left side, a red red circle, it's basically I when, when I really believe that we won't see anybody releasing and fixing this, so those plugins are f de facto uh going to be broken from now on.

G

um And then, if you look at the diff, you will see that on this pr. Indeed, we are removing all together the digester library from the dependency tree, not just upgrading it or something.

C

A

Yeah, of course, mentioning that when we do such changes, there is always a risk that there would be third-party plugins. For example, there are vendors who provided their plugins outside of the main repository, let's say sonar.

A

We do not scan and analyze these plugins by default and also there are zillions of proprietary plugins developed by companies just for their own use. So there is a risk that something else will be broken from sure.

G

Sure I mean this is always you know, pros and cons. You know um about what you just said, though, for open source plugins, uh we didn't do just a scan using the search feature.

G

We also used usages in plug-in feature tool that that's, if people here don't know all about this one basically is a tool that is going to retrieve all hpis from all every every single uh jenkins plugins in the ecosystem and scan the bytecode to see where whether there is a usage of a given class in that, and so we did that on on orgs, auragapachi commerce, digester digester, the class, uh the one from jenkins school itself and danielle, I think, was nice enough to to to to catch our uh one of the mistakes we did and and to scan for the whole uh old classes from digester.

G

Basically- and this just showed, as far as I understood what danielle wrote like in the last comments or something- and these are these very pr- not not additional hits in terms of findings, so the list at the top of this pr should be still accurate.

G

It is deemed to fix the whole ecosystem provided again, which is not going to happen as far as I think, provided we would merge and release every single pr that we have filed.

A

But we still have alternative, because even if you don't ship it as a detached plugin, you can ship with is just the api plugin users can install on demand. So we can say that if you have uh one of these plugins uh available without a fix, you just install the this additional plugin and everything starts working.

F

Because the api plugin wouldn't be on the class path of this plugin yeah, what we can do is detaching and not bundling it, which is an option, but apparently jesse somewhere said that this isn't great. I'm to be honest, I'm a bit confused by the approach chosen here, because what is this? You said um we had the option going for a detached, plug-in or fixing up at the ecosystem, and you said yeah, let's fix up the ecosystem and immediately afterwards you said. Oh look at all of these plugins. We cannot fix, isn't that I.

G

Mean yeah, I don't know what you're saying so what I mean that we need to, I think, the diligence to file you know every single pr's, but then I'm saying I don't think as a jenkins as a project as an open source community. We should be you know releasing I mean I understand, okay right, it's a bit confusing or ambiguous.

G

um I'm saying we yeah, we I'm I mean yeah, we filed a pr that would fix every single plugins. That is impacted, but we I mean are personally at least I'm not very eager on getting and becoming a maintainer on on uh vss genexis java test report, blemisher version.

G

uh I think those plugins are not used enough to be too mandating to be mandating that basically, so yes, we have done to show that we we value that. But on the other hand I think it's it's an example of shifting gears and yes accepting that breaking some things is a choice that we can do. I think we could do. We maybe should do just to move forward and keep things simple. Basically,.

A

G

A

Guess we would need a job anyway, taking the conversation on the mailing list. Maybe before the jab is filed, it makes sense to build a consensus of what bus we choose, because the if.

H

A

Has the reservations about the chosen approach? Maybe we need to resolve it before we spend time on jabs.

G

Yeah I mean so danielle pointed rightfully on the compatibility matters of the governor's document, but indeed, as was pointed out by liam, maybe you you can open this one. If you know what I mean oleg, but so that those people don't not as knowledgeable as about that, uh can see uh watching this record as a recording later, you could see what we talked about, but this uh this phrasing also talks about being very careful. I think we are very careful here. uh You know this phrasing doesn't mean that we don't break anything.

G

uh I think it's it's. We know that as professional in software that breaking nothing ever is also something to keep you you know uh is an impediment to to to innovate and to move forward, and sometimes.

C

This might be a good reasoning, kind of catalyst and candidate for jenkins 3.0 right. This is something that will break um it's a major version. A lot of people complain that we release uh non-major versions that have breaking changes, even though our definition of breaking is different. So that would be a good excuse is something we're like okay, we've released this new we've changed the behavior.

C

Some plugins are going to break that's 3.0.

G

C

And we just start collecting a bunch of these changes that we want to do for 3.0 release.

G

Yeah, but I mean I I I like the the the rational. The only big caveat that I see with that rationale. Is that then, do you bump the major version each time you have something like this and because I know, for instance, guava is coming. We are working on guava too.

A

G

So uh right we bump to four, then when we reach guava stage and so on you know I.

C

I'm honestly, okay with that as well, but I mean there's no reason we can't you can't wait to merge this for guava as well right that both of those could be a 3.0 release.

G

C

G

Take more time there are three hundreds plugging inspected as far as our analysis, but.

C

I mean chrome is now on 87 or 99, or something like that, like they're, releasing major versions all the time and that's totally fine as well actually.

A

Changing the version was one of proposals for jenkins 3.. So as long as I'm cleared uh to publish my proposal, hello mark, um I will be happy to do that.

C

I think, as long as we're clear with users, I don't think I think to daniel's point and to your point um breaking something is not something we want to do often, but it's not a problem to do as long as we're good at communicating it. I'm not necessarily sure we're good at communicating it, and a major version would be a key to users that there will be something breaking.

F

We've never had december, so starting now seems kind of weird plus. uh If we, if we go the road and I and I hope we continue, don't get me wrong, uh I think it's it's good that we look at all of those outdated dependencies. I mean extreme spring.

F

Security uh was a great step forward that might have made the 3-0 or perhaps tables to divs would have been the 3-0, and we would now be at four point something because both of them would deserve a major version bomb, um but we've never had summer, and uh if we start now, we really should apply it in the way it is intended- and I mean only is on the call and warnings ng is that major version nine or something uh by now and he's really doing it and he got there in less than a year.

F

So look forward to uh jenkins 20 uh next year or something and at that point we can go the browser route and say everything's a major version or just you know, ubuntu. This was released in 2021, so that's the version number we're using for it. Okay,.

G

Yeah, but you know also that if we do that there will be, you know what I'm going to call a major version fatigue that people will start carrying. That is a major version of date and just or maybe not upgrade anymore and move away from jenkins. You know uh if we br, if we make this like looking like, we are going to break everything each time which.

C

Is not the case here, you know.

G

C

Definitely a balance there right yeah because you don't want to do a new major version each week. Otherwise that doesn't mean it's a major version. But if you never do a major version, then people complain that the weekly is different than the previous version. So you got to find the right balance and I don't have an answer right now and.

A

So from our strong opinions, you're welcome to start a discussion on the developer, my link list uh for this particular topic. I think that we are definitely not ready to vote for the past, so I suggest we continue the discussion in the developer's mind. At least uh you know you know I mean.

G

If we're going to create a anyways, but you know if, if we think that it's going to be a compromise to create a detached plugin, why I mean I'm? I don't really I'm not going to to to fight for it. I don't want to. I won't die on this hill.

G

I'm just thinking that it's time to kind of buy the bullet, I would say if you look at the numbers, those plugins are installed like the biggest one is installed not even 500 times my my personal plugin, that's a very, very small one is installed 4k times.

G

Most of those plugins are installed like 60 times or 100 times, 160 times the world, so I'm like yeah, it's not probably most of those instances are just having those plugins stolen. They forgot about them.

F

I mean my emma seems: 3.2 clover.

D

2.8 am I stat since 10 years. I wonder if someone's really using.

A

D

A

Format because this plugin publishes a report in a particular format, it doesn't mean that you, you have to use emma tool for that.

F

Okay, I mean, um I mean, I think I think we can move on, uh but just I think correct me. If I'm wrong, uh there will be a jab and the key part of that jab should be um explaining which of the alternatives was chosen. And why, because I see yeah sure and the detached plug-in, perhaps even without bundling, if we want to get rid of the dependent of the plug-in as part of the.

F

What we deliver sort of um taking bazel's approach, and just you know, accelerating it by a few years, um might actually be a viable alternative. And if not, if you think that's not a good good solution. I would just like to.

G

Know why sure we will create a job? Definitely, I think it makes sense to exercise the process and so on, I'm fine for everybody attending here or people watching differently. Later I encourage you to you, know, watch the list of plugins that are already marked deemed as to be broke breaking when this is released and voice your opinion, if you think that none of this progress makes sense anymore, like like willie, was saying about mf. Typically, I'm interested, we are interested to hear your opinion and yeah there will be a jib. Thank you very much.

A

Thank you, john okay, then, moving on so.

C

One, uh this might be another one where you might want to email the users list and be like we're potentially doing a breaking change to these plugins. Don't say it's a chord change, but the plugins look to see how many active users there are, as opposed to just people who has installed them.

G

Good points um I mean, maybe I could still point to the core pr but yeah yeah yeah sure I can do.

E

That thank you.

A

Yeah so technically it's possible to do some things like that with the telemetry engine in jenkins, but yeah it would require very much engine.

G

Yeah same thing: to ask again what.

A

uh So there is jab 215, vertical character.

C

All the analytics.

A

Yeah so technically it would be possible to collect metrics like that from the jenkins side, I know not to 14., but it would require change in the weekly release. So you wouldn't get information from lcs and I guess that the majority of such less adopted plugins are rather lts versions.

G

Yeah suspect also that you know this thing will never be really used, because it would mean that we wait for some time uh to percolate for the versions, and I guess many many people are using an old version of jenkins using a low version of plugins that actually would never see just such a a change in the core itself. Yeah.

A

I'm not pushing for telemetry.

F

For this change, so we can telemetry we've previously backported into lts because of the timing aspect to it. So we could do that here. I think I think we even backported broken stuff, so I would recommend you write better code than me and in terms of understanding the version combinations that users of these plugins are using. We have the usage statistics.

F

Site that has a matrix of core versions and plug-in versions. So, for example, if the pattern is that everyone on emma plug-in is still on jenkins, one point x, that would tell us that they are- and we can say well they're never going to update anyway. So we can stop caring about this particular.

F

C

C

Yes, now you can move on sorry, oleg.

A

Yeah no worries, so the next topic for us is terminology. So for terminology we recovered this topic. There is a threat where we are trying to agree exist on some terms and, yes, they made a call for terms. We seem to have a consensus so yeah. Basically this the terms are listed here and yeah. I'm going to exclude a few terms right.

A

H

A

Just oh yeah uh yeah so here, for example the yo. What we have right now, so master node, built-in node master label, master branch agent to master security, jenkins master container.

A

So for port. It doesn't seem that we have a consensus right now, because there is still ongoing discussion of how we should call it whether it should be controlled. What causes conflicts in uh kubernetes terminology?

A

So I guess this topic I will exclude from the list for now. We need to keep discussing that and the civilization uh white list would be now civilization. Allow list it's for jab 200, because it's also quite deeply integrated into our documentation and the code code base. So this is uh these are the terms I would uh suggest uh to photon unless there are concerns about any of this term and that we need to keep discussing them.

C

I mean I already mentioned on the mailing list. I'm happy with the list, especially now that it switched from allow to sorry permit to allow.

B

Yes, likewise, for me, I think the list looks.

D

F

Do we expect potential readability issues with english as a second language, with.

B

Built-In, no it's quite a common word. Well so so is there? Would there be an objection to hyphenating it? I think built dash in.

F

B

F

Hyphenated labels.

B

Are weird, I think? Oh, they.

F

B

Okay, so that's all right, then then I retract, thank you daniel. I.

F

Think there may even be a uh grammatical non-determinism in the antler program. For this. Oh, oh, then, absolutely retract! Thank you. I don't know whether a hyphen is enough to get there. I don't think so, but it should be just alphanumeric.

A

F

We are talking about this.

A

J

About this mission.

A

J

Well, the name is second, the label.

K

J

G

K

Would work but it would be a bit earlier. Even yes, I mean a self would be an option, but I still like built in better.

B

Yeah built-in built-in gives the right message, and I think we should accept. Yes, english as a second language may wrestle with it for a while.

F

Then that's fine with me. It's just something. Looking at the term, it looks like thin. The metal.

I

So so I generally uh plus one from me too, but I like yeah this. This uh label looks weird and so I'm I'm sorry, maybe I'm I'm stupid. But what's the problem with the hyphen there.

F

um The label is used in logical expressions um and I think the parser that we have for those um may have problems with certain um special characters um and I've also in the past, have trouble with the auto completion uh code for labels now. Obviously, all of that is something that we can probably work on, but it would increase the scope there, a bit.

A

Okay, there are some methods, because if we make using a controller label as difficult as possible, most people will use it, but speaking seriously,.

B

That's actually a good point well, and I can confirm that I do use labels with hyphens in them all over my installation.

B

I haven't detected any problems yet with freebsd-12 or amd64-freebsd that are provided by the platform labeler plug-in so.

G

But I mean, I think, maybe that's what I'm not sure. That's what you meant to like, but you nailed it. We don't want people to use built-in labor anyways. You should.

A

Have so much they explicitly want that, so we cannot delete this feature. Obviously,.

I

We want to be able to.

A

Delete support for master due to computability uh but yeah using hyphen.

F

Is not a problem for me yeah, that's actually a good point. I mean one of the suggestions that we discussed for for the replacement term might have been marx was reserved to indicate do not use this. Do not build here, um and we recently also added a more visible warning message to the jenkins ui a few weeks ago. That basically said do not configure jenkins to run builds on the built-in node. So um I I would like to retract my.

A

Concern here, so we take built-in user heathen because nobody wants to consider this option right. I also found about that. It depends.

H

What's the label.

A

I think the same is key offense.

C

I think if it's messy, it's fine, because a we're not recommending people do it and b it's pretty easy to type and sticks with the convention lowercase and like labels.

C

So I I mean I can see why built in is looking like bill tin, but I I think, for a label that we don't encourage. I think it's fine and it's yeah or that.

F

So to clarify you're saying no hyphen.

C

I hate punctuation, I never use it so.

B

Yeah, okay and I'm I'm still the other direction. I think the hyphen would be a real help, so.

C

We have no objections, hyphen, so, let's I think we can.

G

On top of that, you know we were talking about drinking itself, but you know now we have, I mean yaml configurations, code, things everywhere, groovy scripts, and sometimes things like these yeah might be weird or broken somewhere. We were talking about compatibility a few minutes ago right so.

F

So my suggestion for a responsible war would be that we agree on built-in node and the built-in label and we will attempt to hyphenate it unless we discover specific, real and not trivially addressed technical problems with that. In that case, we fall back to not having a hyphen in the label.

I

Yeah, I'm a so so two comments. When you put a hyphen in there, then it doesn't look weird anymore, so we can get rid of that comment, but I do use hyphens in my uh labels too. So.

C

Honestly, there's no reason we couldn't support both and just document. One.

D

C

F

C

Well, we're gonna have to support master anyways.

F

uh Actually, we don't. If you look at my pull request, as I suggested on the double list you will see, there is migration code, an administrator who is updating from earlier versions of jenkins needs to click, a shiny button to switch from master to built in, and only folks who start jenkins for the first time in whatever release of jenkins includes. This change will have the built-in label by default. What about.

C

Any pipelines that use node master.

F

Well, you can explicitly configure additional labels if you need that to work, but there can only be one what is called internally a self label. It is kind of an implied label that usually corresponds to the node name, except for the building node, where it is currently master and would be something else in the future.

C

Okay, then, I retract I'm good with the with the dash.

A

So too long did you entry to it's an upgrade gate for that.

C

A

C

F

I mean uh the thing is: if you upgrade jenkins, nothing will change except there will be an admin monitor that says: click here to get the new behavior with a link to documentation. We.

A

Already agreed that the configuration of code use cases might be affected, the configuration of code use cases become default ones in 2021, so I think that upgrade guide will.

C

And probably most of the people who are using that node label are not the ones that are upgrading anytime soon.

D

So it's good to.

A

A

Okay, so uh yeah one of the options. We can still uh continue discussion for this term, so basically the only consequence that we are blocking daniel for another for some time until we build the consensus uh but yeah, I think I'm finding this building.

F

A

So there is comment from batista in the chat that he prefers self. I know I think we were joking around okay.

I

Yeah, I feel like this. This dash is my first contribution to the the jenkins governance board meeting, so we have to keep it at least for until another meeting yeah.

C

I I mean as much as I do like stuff. I think built-in is way clearer.

A

So it's okay, so yeah anything to discuss on terminology um because yeah we have one important topic. I would like to close today.

B

So so we have closure already on the all the other topics on terminology. We're we're settled right, um yeah, that's uh what I'm asking.

A

Okay, good european, okay, so yeah. The next question is about uh jenkins about securing uh delivery pipelines for jenkins. So one of follow-ups we discussed at the governance meeting that we would like to adopt security tools and one of the tools we had in the list was lfx security, which is basically a sas version of sneak provided by the linux foundation and yeah after the contributor summit. I started this exploring it. Basically, we already have a profile.

A

um Well, it doesn't quite work as we discussed one of the previous board meetings, because.

A

Because of uh too many uh dependency issues- and this think is not good at parsing- how our dependency trees work because well, none of existing tools have any idea about how our dependency management works. So we end up with something like 200 sudden issues, mostly false positives and as a follow-up I reached out to fact, security team asked whether we could uh basically fix it somehow in a way which would be scalable for the jenkins project dancing is no.

A

Then we agreed to talk to sneak directly. We start the conversation with me. As a part of this conversation, we discovered that there is a new lfx security 2.0 on the works and, basically in discussion. They intend to provide administrative console for users as well as apis and including configuration management, apis and apis for triggering scans. So all the things you get in classic sneak, which would allow us to submit the ignore lists for cvs. We don't like to see and yeah.

A

Basically, they invited us to participate in the discovery project, and I asked for formal permission to accept this invitation, so what it means for us that yeah, basically, we agreed to participate.

A

uh No commitment but yeah once there is a pilot version ready, we invited to try it out and adopt.

A

If the project is successful, we would make a joint announcement together with sneak and the linux foundation, and the agencies will be basically listed as one of the first projects at optical effects: security 2 with maybe some testimonials, testimonials, etc, like it usually happens, and what we get out of that we will get direct support from sneak and effect security, while adopting that, because yeah most likely in the pilot, we will experience some issues, so we provide feedback and we get help, and hopefully, with this mode, we will be able to reload support for sneak soon.

A

So currently we have uh all eva interested um in the security organization. There were also some clarification. Questions from daniel palarges daniel is interested as a security officer that is being informed about this project and yeah. My question is whether we want to accept it as a private project.

D

F

Definitely I I really see no downside here worst case. We try it and cannot get it to work. The way we need and best case we have.

F

um We have a dependency scanner that actually works for the crazy ways in which we use maven and um has a useful results, um and since it has an api, I think I watch the the recording um that might actually be interesting uh if we, if we would consider exposing this showing uses hey by the way, um there's a bunch of old stuff in this plugin, you may not want to install anymore, um which sort of feeds into this plug-in deprecation topic as well.

F

Now, obviously, this isn't quite as straightforward, but I see I really see no downside here so plus one.

A

Any objections.

H

What's one for me, that's one from me as well.

A

Yeah and another topic, we are looking for maintainers who are interested to participate in the pilot program. So the idea that we would start from a limited number of repositories like jenkins course, some libraries and some plugins and we would be running out of executive entire organization only after.

A

That, if someone is interested, please comment in the mailing.

A

A

Okay, so I think we can consider it is approved, yep, okay, so quick update on the hosting team. I wanted to do.

B

A

Today, for onboarding new contributors, even though we had a few contributors who accepted the invitation, they didn't show up. So basically the meeting was cancelled. Well, we still had another discussion with daniel and alexa and we created slides, which I posted in the thread. So we, if you're interested you, can just take a look, and once we have somebody who is committed to participate, we will reorganize the meeting and create recording for this slide.

A

The slide deck is basically enough to understand the idea and to get all the links, so it should be okay, even in a centralized.

A

A

Okay, so we have a bunch of topics here, and one topic I want to discuss is job project process updates, so it can be done later when we have a pull request and there is a quite active discussion, so we can just give consensus, even with the without governance meeting there and yeah for the rest yeah. I wanted to discuss using github wishes for open governance, but yeah one question to both members that if you could provide feedback on that in the portfolios, they would appreciate that.

C

Yeah, I'm kind of leaning towards calling in here because it's been long day meetings and we're over time.

A

Yep, but I'm also wrapping up so no intention to discuss now, I'm just highlighting that this topic is very. It will be great to have asynchronous discussion.

A

Yeah, so I will move everything to the next link.

A

Okay, anything else for today.

E

C

Okay, I'm off bye.

H

Thanks everyone.

A

Have a great day.

I

Thanks so much.

A

Thanks yeah I'll publish, uh recording tomorrow, I guess because it's 10 p.m in my time zone. Thank you. Thank you. Thanks all.